Japan Weighs Mandatory Cybersecurity Measures After Data Exposure Surpasses 100 Million

October 16, 2026

japan tokyo technology localgovernment privacy cybersecurity japannews cyberattack datasecurity databreach cloudsecurity expatlife japanbusiness telecom informationsecurity expatsinjapan workinjapan japanvisa businessinjapan livinginjapan japantech digitaljapan foreignersinjapan japanlaw visainjapan

Summary

Japan is considering mandatory cybersecurity measures for telecommunications operators following a string of unauthorized-access incidents. Proposed requirements could include advance vulnerability checks, data encryption and stronger oversight of contractors and subcontractors. The government is also examining whether it should be able to order a temporary suspension of operations after serious information leaks. Recent cases reportedly affected 495 companies and municipalities through IDC Frontier and potentially 195 municipalities through Arcadia. Sourcenext has warned that about 22.5 million items of information may have been exposed. JNN’s tally puts the cumulative number of potentially affected records over the past three weeks at more than 100 million. The figures remain subject to investigation, and exposure does not automatically mean every record was accessed. Read the full article for the background and what the proposed rules could mean for companies, municipalities and foreign businesses in Japan.

Japan Weighs Mandatory Cybersecurity Measures After Data Exposure Surpasses 100 Million

Japan considers stronger cybersecurity obligations

Japan’s Ministry of Internal Affairs and Communications is considering new requirements that would oblige telecommunications operators to take preventive measures against cyberattacks, according to information reported by JNN. The proposed framework could require companies to identify system vulnerabilities in advance, encrypt sensitive data and manage information across their entire supply chains, including contractors and subcontractors.

The ministry is also examining possible legal revisions that would allow the government to order a temporary suspension of operations if a serious information leak occurs. Such a measure would represent a significant expansion of the authorities’ ability to respond to cybersecurity incidents involving communications infrastructure and related digital services.

Recent incidents raise concern across Japan

The discussion comes after a series of cyber incidents affecting companies, local governments and public-facing services. On the seventh of this month, IDC Frontier, a SoftBank subsidiary providing data-center and cloud-related services, suffered unauthorized access. The incident reportedly affected 495 companies and municipalities.

In another case, Arcadia, which handles disaster-prevention email distribution for local governments, was hit by unauthorized access. Information may have been exposed involving 195 municipalities nationwide. Disaster-alert systems are especially sensitive in Japan, where local authorities use digital messaging to provide residents with warnings about earthquakes, typhoons, heavy rain and other emergencies.

Security software and digital-service provider Sourcenext also announced that approximately 22.5 million items of information may have been exposed. Separately, the manga distribution service Comic C’Moa suspended operations after determining that unauthorized external access was highly likely.

More than 100 million records reportedly affected

According to JNN’s compilation, the total number of potentially affected records across incidents reported during the past three weeks has exceeded 100 million. The figure refers to cumulative exposure reported in connection with multiple cases and does not necessarily mean that every record was confirmed to have been accessed or misused. Investigations will be needed to determine the precise scope of each incident.

Nevertheless, the scale highlights the growing importance of cybersecurity in Japan’s increasingly connected economy. Telecommunications carriers, cloud providers, software companies and outsourced service operators often support multiple businesses and public bodies. A breach at one supplier can therefore have consequences far beyond a single organization.

Focus on supply-chain security

The ministry’s proposed approach reflects a broader shift from responding to attacks after they occur to requiring organizations to prepare in advance. Vulnerability assessments, stronger encryption, access controls, incident reporting and coordinated data management could become more important elements of compliance for telecommunications operators.

Including contractors in the proposed rules is significant. Many large Japanese companies and public institutions rely on external providers for cloud computing, customer support, software maintenance and data processing. A unified approach could help reduce gaps in protection between a major operator and smaller companies working on its behalf.

Balancing security and service continuity

A government power to order temporary business suspensions would likely face careful debate. Suspending a digital service may limit further damage, but it could also affect customers, municipalities and essential communications. Policymakers will need to establish clear thresholds, emergency procedures and support mechanisms before introducing such authority.

For residents, businesses and foreign companies operating in Japan, the developments underline the need to review passwords, authentication practices, software updates and third-party data handling. Japan’s effort to strengthen cyber resilience could improve trust in the country’s digital infrastructure, while ensuring that new rules remain practical will be essential for innovation and service reliability.